svn commit: r310729 - head/contrib/bsnmp/lib

[Ngie Cooper]

Author: ngie
Date: Thu Dec 29 00:20:03 2016
New Revision: 310729
URL: https://svnweb.freebsd.org/changeset/base/310729

Log:
  Prevent improper memory accesses after calling snmp_pdu_free and snmp_value_free
  
  snmp_pdu_free: set pdu->nbindings to 0 to limit the damage that
  could happen if a pdu was reused after calling the function, and
  as both stack and heap allocation types are used in contrib/bsnmp
  and usr.sbin/bsnmpd.
  
  snmp_value_free: NULL out value->v.octetstring.octets after calling
  free on it to prevent a double-free from occurring.
  
  MFC after:      2 weeks

Modified:
  head/contrib/bsnmp/lib/snmp.c

Modified: head/contrib/bsnmp/lib/snmp.c
==============================================================================
--- head/contrib/bsnmp/lib/snmp.c	Wed Dec 28 23:55:18 2016	(r310728)
+++ head/contrib/bsnmp/lib/snmp.c	Thu Dec 29 00:20:03 2016	(r310729)
@@ -1154,8 +1154,11 @@ snmp_pdu_dump(const struct snmp_pdu *pdu
 void
 snmp_value_free(struct snmp_value *value)
 {
-	if (value->syntax == SNMP_SYNTAX_OCTETSTRING)
+
+	if (value->syntax == SNMP_SYNTAX_OCTETSTRING) {
 		free(value->v.octetstring.octets);
+		value->v.octetstring.octets = NULL;
+	}
 	value->syntax = SNMP_SYNTAX_NULL;
 }
 
@@ -1216,6 +1219,7 @@ snmp_pdu_free(struct snmp_pdu *pdu)
 
 	for (i = 0; i < pdu->nbindings; i++)
 		snmp_value_free(&pdu->bindings[i]);
+	pdu->nbindings = 0;
 }
 
 /*